load USB via GP

[SuperHans]

I am really stuck with this. My predecessor kindly left no information about the group polices in place, and after re-imaging some machines with a new image I created I realised that the local polices were not set via GPOs. So I went in and edited the default domain GPO to allow domain\everyone and domain computers to load\unload drivers and silently succeed at unsigned drivers.

This however did not work. I checked the permissions that these objects had which are read and apply. Logged on as a network administrator and ran gpupdate then gpresult and the results (which point to something not being right) are:


N:\>gpresult

Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 10/09/2008 at 12:37:31




COMPUTER SETTINGS
------------------

Applied Group Policy Objects
-----------------------------
Default Domain Policy
Stations
Internet Proxy Configuration
LOGON WARNING

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------

Local Group Policy
Filtering: Not Applied (Empty)

The computer is a part of the following security groups:
--------------------------------------------------------
BUILTIN\Administrators
Everyone
SophosAdministrator
SophosUser
BUILTIN\Users
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
IT-100$
Domain Computers


USER SETTINGS
--------------

Applied Group Policy Objects
-----------------------------
Default Domain Policy
Internet Proxy Configuration
Supervisors
Login Scripts

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Local Group Policy
Filtering: Not Applied (Empty)

The user is a part of the following security groups:
----------------------------------------------------
Domain Users
Everyone
SophosUser
SophosAdministrator
BUILTIN\Users
BUILTIN\Administrators
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
LOCAL
Staff
Supervisors
Ashcombe Internet Access
Domain Admins
Students
Everybody


The computer local security policy should be applying. It should work as the OU where the computers are not blocking inheritance of the default domain policy. The default domain policy is also enforced.

Can anybody shed some light on this issue?!

[penfold]

You shouldn't touch the default policy. It is too easy to mess it up. Instead create a new policy and apply that one to the OU where you computers are.

You may want to check that you have them set so they wait for the network when booting so they will pull down all the changes from the GPO on first boot rather than after a few reboots.

[SuperHans]

There is already one applied to our workstations OU, and split into rooms, they all inherite from that but the same issue is still happening. We do have two DCs and I wondered if it was a problrem with replication but it has been a few days now!

[SuperHans]

I went and had another look, and the local security polices look like they are correct when I log in as an administrator, e.g. load/unload device drivers and the unsigned drivers to silently suceed, and everybody on the security settings. However when I log in as a student iI obvisouly can't check those settings are the same, although I can't see why they wouldn't be, but the problem still occurs...